winsock2.pas

由于该木马有三个服务端可以选择生成

{
  Delphi Winsock2 Static Unit by Aphex
  http://www.iamaphex.cjb.net
  [e-mail]
}

unit Winsock2;

interface

{$ALIGN OFF}
{$RANGECHECKS OFF}
{$WRITEABLECONST OFF}

uses Windows;

const
  WINSOCK_VERSION = $0202;
  WINSOCK2_DLL = 'WS2_32.DLL';

type
  u_char  = Byte;
  u_short = Word;
  u_int   = DWORD;
  u_long  = DWORD;
  TSocket = u_int;
  WSAEVENT = THandle;
  PWSAEVENT = ^WSAEVENT;
  LPWSAEVENT = PWSAEVENT;
{$IFDEF UNICODE}
  PMBChar = PWideChar;
{$ELSE}
  PMBChar = PChar;
{$ENDIF}

const
  FD_SETSIZE = 64;

type
  PFDSet = ^TFDSet;
  TFDSet = packed record
    fd_count: u_int;
    fd_array: array[0..FD_SETSIZE-1] of TSocket;
  end;
  PTimeVal = ^TTimeVal;
  TTimeVal = packed record
    tv_sec: Longint;
    tv_usec: Longint;
  end;

const
  IOCPARM_MASK = $7f;
  IOC_VOID = $20000000;
  IOC_OUT = $40000000;
  IOC_IN = $80000000;
  IOC_INOUT = (IOC_IN or IOC_OUT);
  FIONREAD = IOC_OUT or (SizeOf(Longint) shl 16) or (Ord('f') shl 8) or 127;
  FIONBIO  = IOC_IN  or (SizeOf(Longint) shl 16) or (Ord('f') shl 8) or 126;
  FIOASYNC = IOC_IN  or (SizeOf(Longint) shl 16) or (Ord('f') shl 8) or 125;
  SIOCSHIWAT   = IOC_IN  or (SizeOf(Longint) shl 16) or (Ord('s') shl 8);
  SIOCGHIWAT   = IOC_OUT or (SizeOf(Longint) shl 16) or (Ord('s') shl 8) or 1;
  SIOCSLOWAT   = IOC_IN  or (SizeOf(Longint) shl 16) or (Ord('s') shl 8) or 2;
  SIOCGLOWAT   = IOC_OUT or (SizeOf(Longint) shl 16) or (Ord('s') shl 8) or 3;
  SIOCATMARK   = IOC_OUT or (SizeOf(Longint) shl 16) or (Ord('s') shl 8) or 7;

type
  PHostEnt = ^THostEnt;
  THostEnt = packed record
    h_name: PChar;
    h_aliases: ^PChar;
    h_addrtype: Smallint;
    h_length: Smallint;
    case Byte of
      0: (h_addr_list: ^PChar);
      1: (h_addr: ^PChar);
  end;
  PNetEnt = ^TNetEnt;
  TNetEnt = packed record
    n_name: PChar;
    n_aliases: ^PChar;
    n_addrtype: Smallint;
    n_net: u_long;
  end;
  PServEnt = ^TServEnt;
  TServEnt = packed record
    s_name: PChar;
    s_aliases: ^PChar;
    s_port: Smallint;
    s_proto: PChar;
  end;
  PProtoEnt = ^TProtoEnt;
  TProtoEnt = packed record
    p_name: PChar;
    p_aliases: ^Pchar;
    p_proto: Smallint;
  end;

const
  IPPROTO_IP = 0;
  IPPROTO_ICMP = 1;
  IPPROTO_IGMP = 2;
  IPPROTO_GGP = 3;
  IPPROTO_TCP = 6;
  IPPROTO_PUP = 12;
  IPPROTO_UDP = 17;
  IPPROTO_IDP = 22;
  IPPROTO_IPV6 = 41;
  IPPROTO_ND = 77;
  IPPROTO_ICLFXBM = 78;
  IPPROTO_RAW = 255;
  IPPROTO_MAX = 256;
  IPPORT_ECHO        =   7;
  IPPORT_DISCARD     =   9;
  IPPORT_SYSTAT      =  11;
  IPPORT_DAYTIME     =  13;
  IPPORT_NETSTAT     =  15;
  IPPORT_FTP         =  21;
  IPPORT_TELNET      =  23;
  IPPORT_SMTP        =  25;
  IPPORT_TIMESERVER  =  37;
  IPPORT_NAMESERVER  =  42;
  IPPORT_WHOIS       =  43;
  IPPORT_MTP         =  57;
  IPPORT_TFTP        =  69;
  IPPORT_RJE         =  77;
  IPPORT_FINGER      =  79;
  IPPORT_TTYLINK     =  87;
  IPPORT_SUPDUP      =  95;
  IPPORT_EXECSERVER  = 512;
  IPPORT_LOGINSERVER = 513;
  IPPORT_CMDSERVER   = 514;
  IPPORT_EFSSERVER   = 520;
  IPPORT_BIFFUDP     = 512;
  IPPORT_WHOSERVER   = 513;
  IPPORT_ROUTESERVER = 520;
  IPPORT_RESERVED    =1024;
  IMPLINK_IP         = 155;
  IMPLINK_LOWEXPER   = 156;
  IMPLINK_HIGHEXPER  = 158;
  TF_DISCONNECT      = $01;
  TF_REUSE_SOCKET    = $02;
  TF_WRITE_BEHIND    = $04;
  INVALID_SOCKET     = TSocket(not(0));
  SOCKET_ERROR       = -1;
  FROM_PROTOCOL_INFO = -1;
  SOCK_STREAM     = 1;
  SOCK_DGRAM      = 2;
  SOCK_RAW        = 3;
  SOCK_RDM        = 4;
  SOCK_SEQPACKET  = 5;
  SO_DEBUG            = $0001;
  SO_ACCEPTCONN       = $0002;
  SO_REUSEADDR        = $0004;
  SO_KEEPALIVE        = $0008;
  SO_DONTROUTE        = $0010;
  SO_BROADCAST        = $0020;
  SO_USELOOPBACK      = $0040;
  SO_LINGER           = $0080;
  SO_OOBINLINE        = $0100;
  SO_DONTLINGER       = not SO_LINGER;
  SO_EXCLUSIVEADDRUSE = not SO_REUSEADDR;
  SO_SNDBUF           = $1001;
  SO_RCVBUF           = $1002;
  SO_SNDLOWAT         = $1003;
  SO_RCVLOWAT         = $1004;
  SO_SNDTIMEO         = $1005;
  SO_RCVTIMEO         = $1006;
  SO_ERROR            = $1007;
  SO_TYPE             = $1008;
  SO_CONNDATA         = $7000;
  SO_CONNOPT          = $7001;
  SO_DISCDATA         = $7002;
  SO_DISCOPT          = $7003;
  SO_CONNDATALEN      = $7004;
  SO_CONNOPTLEN       = $7005;
  SO_DISCDATALEN      = $7006;
  SO_DISCOPTLEN       = $7007;
  SO_OPENTYPE         = $7008;
  SO_SYNCHRONOUS_ALERT    = $10;
  SO_SYNCHRONOUS_NONALERT = $20;
  SO_MAXDG                 = $7009;
  SO_MAXPATHDG             = $700A;
  SO_UPDATE_ACCEPT_CONTEXT = $700B;
  SO_CONNECT_TIME          = $700C;
  TCP_NODELAY              = $0001;
  TCP_BSDURGENT            = $7000;
  SO_GROUP_ID              = $2001;
  SO_GROUP_PRIORITY        = $2002;
  SO_MAX_MSG_SIZE          = $2003;
  SO_Protocol_InfoA        = $2004;
  SO_Protocol_InfoW        = $2005;
{$IFDEF UNICODE}
  SO_Protocol_Info         = SO_Protocol_InfoW;
{$ELSE}
  SO_Protocol_Info         = SO_Protocol_InfoA;
{$ENDIF}
  PVD_CONFIG               = $3001;
  SO_CONDITIONAL_ACCEPT    = $3002;
  AF_UNSPEC       = 0;
  AF_UNIX         = 1;
  AF_INET         = 2;
  AF_IMPLINK      = 3;
  AF_PUP          = 4;
  AF_CHAOS        = 5;
  AF_IPX          = 6;
  AF_NS           = AF_IPX;
  AF_ISO          = 7;
  AF_OSI          = AF_ISO;
  AF_ECMA         = 8;
  AF_DATAKIT      = 9;
  AF_CCITT        = 10;
  AF_SNA          = 11;
  AF_DECnet       = 12;
  AF_DLI          = 13;
  AF_LAT          = 14;
  AF_HYLINK       = 15;
  AF_APPLETALK    = 16;
  AF_NETBIOS      = 17;
  AF_VOICEVIEW    = 18;
  AF_FIREFOX      = 19;
  AF_UNKNOWN1     = 20;
  AF_BAN          = 21;
  AF_ATM          = 22;
  AF_INET6        = 23;
  AF_CLUSTER      = 24;
  AF_12844        = 25;
  AF_IRDA         = 26;
  AF_NETDES       = 28;
  AF_TCNPROCESS   = 29;
  AF_TCNMESSAGE   = 30;
  AF_ICLFXBM      = 31;
  AF_MAX          = 32;
  PF_UNSPEC       = AF_UNSPEC;
  PF_UNIX         = AF_UNIX;
  PF_INET         = AF_INET;
  PF_IMPLINK      = AF_IMPLINK;
  PF_PUP          = AF_PUP;
  PF_CHAOS        = AF_CHAOS;
  PF_NS           = AF_NS;
  PF_IPX          = AF_IPX;
  PF_ISO          = AF_ISO;
  PF_OSI          = AF_OSI;
  PF_ECMA         = AF_ECMA;
  PF_DATAKIT      = AF_DATAKIT;
  PF_CCITT        = AF_CCITT;
  PF_SNA          = AF_SNA;
  PF_DECnet       = AF_DECnet;
  PF_DLI          = AF_DLI;
  PF_LAT          = AF_LAT;
  PF_HYLINK       = AF_HYLINK;
  PF_APPLETALK    = AF_APPLETALK;
  PF_VOICEVIEW    = AF_VOICEVIEW;
  PF_FIREFOX      = AF_FIREFOX;
  PF_UNKNOWN1     = AF_UNKNOWN1;
  PF_BAN          = AF_BAN;
  PF_ATM          = AF_ATM;
  PF_INET6        = AF_INET6;
  PF_MAX          = AF_MAX;

type
  SunB = packed record
    s_b1, s_b2, s_b3, s_b4: u_char;
  end;

  SunW = packed record
    s_w1, s_w2: u_short;
  end;

  TInAddr = packed record
    case integer of
      0: (S_un_b: SunB);
      1: (S_un_w: SunW);
      2: (S_addr: u_long);
  end;
  PInAddr = ^TInAddr;
  TSockAddrIn = packed record
    case Integer of
      0: (sin_family : u_short;
          sin_port   : u_short;
          sin_addr   : TInAddr;
          sin_zero   : array[0..7] of Char);
      1: (sa_family  : u_short;
          sa_data    : array[0..13] of Char)
  end;
  PSockAddrIn = ^TSockAddrIn;
  TSockAddr   = TSockAddrIn;
  PSockAddr   = ^TSockAddr;
  SOCKADDR    = TSockAddr;
  SOCKADDR_IN = TSockAddrIn;
  PSockProto = ^TSockProto;
  TSockProto = packed record